Topic: How dangerous is 'server-only' mode on a public network?

[danielrm26]

I am trying to figure out the dangers of using the 'server-only' mode on a public network prior to putting a firewall in front of it.

I am not running any SMB or FTP on the machine, and I have restricted the local networks to include only the IPs that I want to have access to my mail services.  If I take those IPs out of the local networks it isn't possible to connect to the mail server from those addresses.

So, what are the dangers?

Direct connections to the MySQL port?
DNS?
Proxy?
SMTP?

Any ideas would be appreciated.

Thanks,

-danielrm26

[Charlie Brady]

danielrm26 wrote:

> So, what are the dangers?
>
> Direct connections to the MySQL port?
> DNS?
> Proxy?
> SMTP?

Yes to all the above (from "local" network addresses at least).

> Any ideas would be appreciated.

Server-only mode is not designed for Internet deployment. Don't do it. You can always easily add a second NIC and just have an unused local network, so there's no need to use server-only mode on a public network.

Charlie

[Ray Mitchell]

These links may be of interest
http://www.e-smith.org/docs/
http://www.e-smith.org/docs/papers/smeserver-security.html
Regards
Ray Mitchell

[danielrm26]

Ok, I get that I should not do this, and  I am going to put a firewall in between my public network and my SME box as soon as I can, but my question is better stated this way:

What specifically makes this 'server-only' mode dangerous?

The remote access and email access settings DO work in server-only mode - meaning that I am able to restrict access in seemingly the same way as with gateway mode.

What specifically am I losing in the 'server only' mode?

Ipchains?
TCP Wrappers?
Access to certain services?

Thanks,

-danielrm26

[Charlie Brady]

danielrm26 wrote:
 
> Ipchains?
> TCP Wrappers?
> Access to certain services?

Yes, yes and yes.

Perhaps you should read the code. You should also read the security white paper on this site.

Charlie

[danielrm26]

Hmm.  

I read the docs you suggested before posting the last time.  

There is no specific information in that paper about why my access control would work while in server-only mode.  If my restriction of who can use POP and IMAP works, and the server-manager ACL works, then what is doing this if not ipchains and/or tcpwrappers?

I am looking for specifics that I can't find in the docs.  As for the code, I am unfortunately not advanced enough (yet) to take a casual stroll through it and glean the information that I need.

If you can't help then that is cool.  Thanks for your input up to this point.

-danielrm26